CVE-2026-114277 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz's optional Janrain Engage social login integration in the ecommerce component ties external identities to local accounts improperly. An attacker who controls an external identity can authenticate as a local user account.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments that use the optional Janrain Engage social login integration in the OFBiz ecommerce component are described as affected. Installations on releases before 24.09.08 with that integration enabled are the ones to look at; deployments without it can skip it.
Not affected if fixed-version-24.09.08-or-later, janrain-not-enabled
Who cares apache-ofbiz, ecommerce, java, social-login
unknown if no command is given.24.09.08 or later.Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.